--- title: Google and partners take down the XCPE set-top box... description: Google and industry partners took down the XCPE backdoor, a botnet that infected more than 1.3 million Android set-top boxes. Google assesses with high... canonical: https://daily.dev/posts/google-and-partners-take-down-the-xcpe-set-top-box-botnet-tying-it-to-videostrong-technology-dbdnmlro5 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Google and partners take down the XCPE set-top box botnet, tying it to Videostrong Technology | daily.dev og:description: Google and industry partners took down the XCPE backdoor, a botnet that infected more than 1.3 million Android set-top boxes. Google assesses with high... og:url: https://daily.dev/posts/google-and-partners-take-down-the-xcpe-set-top-box-botnet-tying-it-to-videostrong-technology-dbdnmlro5 og:image: https://api.daily.dev/og/posts/dBdnMLrO5.png og:image:alt: Google and partners take down the XCPE set-top box botnet, tying it to Videostrong Technology og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Google and partners take down the XCPE set-top box botnet, tying it to Videostrong Technology **[Collections](https://daily.dev/sources/collections)** · 2 min read · 7 upvotes · 0 comments ## Summary Google and industry partners took down the XCPE backdoor, a botnet that infected more than 1.3 million Android set-top boxes. Google assesses with high confidence that Videostrong Technology Co., an Android OEM and ODM, built and ran the backdoor intentionally for profit. Videostrong sold device access to criminal affiliates who ran ad fraud, enrolled devices into residential proxy networks, and installed more malware. The malware uses a three-stage architecture (x.cpe, then com.abc.nexus, then downloaded modules) communicating over MQTT. Google expects disrupting the affiliates' command-and-control domains will cut off access to at least 10 million more compromised devices, and has banned Videostrong from building certified Android devices. ## Content Google and industry partners have dismantled XCPE, a backdoor botnet that enrolled more than 1.3 million Android set-top boxes. Google says it has high confidence that Videostrong Technology Co., a Chinese Android OEM/ODM, built and ran the backdoor on purpose, for money. ## How it made money Videostrong sold access to criminal affiliates. The affiliates loaded their own malware modules onto infected boxes. Those modules did three things: ran ad fraud, enrolled devices into residential proxy networks (quietly reselling the owner's home internet connection), and installed more malware. ## How the malware worked It used a modular, three-stage design. The stages are x.cpe, com.abc.nexus, and the modules downloaded afterward, and they communicate over MQTT. It also survives removal by reinstalling itself from the /oem/ partition. Owners of infected boxes need to flash clean firmware or disconnect the devices from the internet. ## The takedown Google took legal action to take down the domains and servers Videostrong used to control the botnet. Disrupting the affiliates' command-and-control domains is expected to cut off access to at least 10 million additional compromised devices, including karaoke machines and telehealth hardware. Google also revoked Videostrong's license to build certified Android devices, including Android TV devices with preloaded Google apps and services. ## The real size Ben Brundage of Synthient called the 1.3 million figure "highly conservative" and said the real scale is likely much higher. Given the 10 million-plus additional devices, that seems plausible. What stands out to me is that the backdoor shipped from the manufacturer, so buyers had no way to avoid it. ## Questions this post answers ### What is the XCPE botnet and how many devices did it infect? XCPE is a backdoor botnet that enrolled more than 1.3 million Android set-top boxes. Google and industry partners dismantled it after assessing with high confidence that Videostrong Technology Co., an Android OEM and ODM, built, deployed, and ran the backdoor intentionally for profit by selling device access to criminal affiliates. _Teams securing IoT and Android device fleets follow botnet takedowns like this on daily.dev._ ### What architecture does the XCPE Android malware use? XCPE uses a modular, three-stage architecture: the first stage is x.cpe, the second is com.abc.nexus, and the third is a set of modules downloaded afterward. The components communicate with each other over MQTT, and affiliates used the access to run ad fraud, build residential proxy networks, and install further malware. _Engineers analyzing malware architectures track technical breakdowns like this on daily.dev._ ### What happened to Videostrong Technology after the XCPE botnet takedown? Google banned Videostrong Technology Co. from building certified Android devices after assessing with high confidence that the company intentionally built and operated the XCPE backdoor for profit. Google also expects disrupting the affiliates' command-and-control domains to cut off access to at least 10 million additional compromised devices. _Developers evaluating device and OEM trust keep up with enforcement actions like this on daily.dev._ ## Similar posts on daily.dev - [Cops bust botnet of 1.3M infected Android TV boxes](https://daily.dev/posts/cops-bust-botnet-of-1-3m-infected-android-tv-boxes-c8w2stdw2) · The Register · 0 upvotes · 0 comments - [Is Your Android TV Streaming Box Part of a Botnet? – Krebs on Security](https://daily.dev/posts/is-your-android-tv-streaming-box-part-of-a-botnet-krebs-on-security-kajzwi9lv) · Krebs on Security · 0 upvotes · 0 comments - [Google and FBI Dismantle NetNut Residential Proxy Botnet](https://daily.dev/posts/google-and-fbi-dismantle-netnut-residential-proxy-botnet-iusqk4knt) · Latest Hacking News · 8 upvotes · 1 comments - [Kimwolf Botnet Hijacks 1.8 Million Android TVs, Launches Large-Scale DDoS Attacks](https://daily.dev/posts/kimwolf-botnet-hijacks-1-8-million-android-tvs-launches-large-scale-ddos-attacks-eacmovs1r) · The Hacker News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#google](https://daily.dev/tags/google), [#android](https://daily.dev/tags/android), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/google-and-partners-take-down-the-xcpe-set-top-box-botnet-tying-it-to-videostrong-technology-dbdnmlro5) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Google and partners take down the XCPE set-top box botnet, tying it to Videostrong Technology","url":"https://daily.dev/posts/google-and-partners-take-down-the-xcpe-set-top-box-botnet-tying-it-to-videostrong-technology-dbdnmlro5","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/google-and-partners-take-down-the-xcpe-set-top-box-botnet-tying-it-to-videostrong-technology-dbdnmlro5"},"datePublished":"2026-11-02T14:35:34.765Z","dateModified":"2026-11-03T02:29:08.782Z","description":"Google and industry partners took down the XCPE backdoor, a botnet that infected more than 1.3 million Android set-top boxes. Google assesses with high...","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/google-and-partners-take-down-the-xcpe-set-top-box-botnet-tying-it-to-videostrong-technology-dbdnmlro5","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":7},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,google,android,malware","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Google and partners take down the XCPE set-top box botnet, tying it to Videostrong Technology"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/google-and-partners-take-down-the-xcpe-set-top-box-botnet-tying-it-to-videostrong-technology-dbdnmlro5#faq","mainEntity":[{"@type":"Question","name":"What is the XCPE botnet and how many devices did it infect?","acceptedAnswer":{"@type":"Answer","text":"XCPE is a backdoor botnet that enrolled more than 1.3 million Android set-top boxes. Google and industry partners dismantled it after assessing with high confidence that Videostrong Technology Co., an Android OEM and ODM, built, deployed, and ran the backdoor intentionally for profit by selling device access to criminal affiliates. Teams securing IoT and Android device fleets follow botnet takedowns like this on daily.dev."}},{"@type":"Question","name":"What architecture does the XCPE Android malware use?","acceptedAnswer":{"@type":"Answer","text":"XCPE uses a modular, three-stage architecture: the first stage is x.cpe, the second is com.abc.nexus, and the third is a set of modules downloaded afterward. The components communicate with each other over MQTT, and affiliates used the access to run ad fraud, build residential proxy networks, and install further malware. Engineers analyzing malware architectures track technical breakdowns like this on daily.dev."}},{"@type":"Question","name":"What happened to Videostrong Technology after the XCPE botnet takedown?","acceptedAnswer":{"@type":"Answer","text":"Google banned Videostrong Technology Co. from building certified Android devices after assessing with high confidence that the company intentionally built and operated the XCPE backdoor for profit. Google also expects disrupting the affiliates' command-and-control domains to cut off access to at least 10 million additional compromised devices. Developers evaluating device and OEM trust keep up with enforcement actions like this on daily.dev."}}]} ```